A hacker enters credentials into a web login page and observes the server's responses. Which of the following attacks is the hacker attempting?

The scenario describes a hacker systematically entering credentials and observing the server's responses. This technique is known as account enumeration (or user enumeration). The goal is to differentiate the system's response to an invalid username from its response to a valid username with an incorrect password. For example, a server might respond with "User not found" for a non-existent account but "Invalid password" for a valid account. This information leak allows the attacker to compile a list of valid usernames for further attacks.

B. Directory traversal is an attack that manipulates file path variables to access files and directories outside of the web server's root directory.
C. Buffer overflow involves sending more data than a memory buffer can handle, which is not the primary action of observing credential responses.
D. Spear phishing is a targeted social engineering attack, usually conducted via email, to deceive a specific individual into revealing sensitive information.

1. Open Web Application Security Project (OWASP). (2020). Web Security Testing Guide (WSTG) v4.2. Section 4.4.1, "Testing for User Enumeration and Guessable User Account (WSTG-IDEN-04)". The guide explicitly describes this attack: "User enumeration is the process of determining whether a username is valid or not on a system... The tester can differentiate between valid and invalid users by observing the application’s responses."

2. Barth, A., & Mitchell, J. (2014). CS 253: Web Security, Lecture 4: Authentication. Stanford University. The course materials discuss vulnerabilities in authentication systems, including how differences in server error messages or response times can be used to enumerate valid user accounts.

3. National Institute of Standards and Technology (NIST). (2015). Special Publication 800-63-2, Electronic Authentication Guideline. Section 5.2.4, "Memorized Secret Verifiers". This document advises that to prevent user enumeration, "The verifier SHOULD NOT provide a different response to the claimant when the user ID is invalid vs. when the authenticator is invalid." This directly addresses the vulnerability being exploited in the question.